CVE-2026-16636 in FluentSMTP Plugin
Summary
by MITRE • 08/06/2026
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The FluentSMTP WordPress plugin presents a critical stored cross-site scripting vulnerability affecting versions up to 2.2.95 that stems from inadequate input sanitization and output escaping mechanisms within its email logging functionality. This vulnerability specifically targets the recipient display name field (to.name) in email logs, creating an attack vector where unauthenticated adversaries can inject malicious web scripts into the plugin's administrative interface. The flaw manifests when attackers craft malicious payloads within the recipient display name parameter of wp_mail() function calls, which are subsequently stored in the plugin's database and executed during specific navigation operations within the admin panel.
The technical exploitation of this vulnerability occurs through the manipulation of email log entries where the to.name parameter contains attacker-controlled content. During normal operation, these stored values are properly escaped when displayed in the main list view of email logs, utilizing the plugin's standard escapeHtml pipeline that protects against XSS attacks. However, the vulnerability emerges specifically when administrators navigate between email log entries using the Prev/Next navigation controls in the detail view, as this particular code path bypasses the standard escaping mechanisms and directly renders the stored display name values without proper sanitization.
This security weakness creates a significant operational risk for WordPress administrators who manage email communications through the FluentSMTP plugin. The attack scenario requires minimal privileges since it targets an unauthenticated threat actor who can inject malicious scripts during normal email sending operations, making the vulnerability particularly dangerous in multi-user environments where various contributors might send emails through WordPress. The payload execution occurs only within the detailed view context of individual email logs when navigation controls are used, meaning that regular users accessing the plugin interface remain unaffected, but administrators who perform log reviews become potential targets for persistent XSS attacks.
The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and represents a classic case of stored XSS where malicious content is permanently saved and later executed without user interaction beyond normal navigation. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 (Phishing via Social Engineering) and T1211 (Exploitation for Privilege Escalation) as attackers can leverage the XSS to steal administrative sessions or escalate privileges through malicious payload delivery. The issue demonstrates poor input validation practices where user-supplied data is not properly sanitized before being stored in persistent database records, combined with inconsistent output escaping that varies based on display context within the application's interface.
Organizations using this vulnerable plugin should immediately implement mitigations including patching to version 2.2.96 or later, which addresses the input sanitization and output escaping gaps in the email logging functionality. Additional protective measures include implementing Content Security Policy headers to limit script execution capabilities, restricting administrative access to only trusted users, and monitoring email log entries for suspicious display names that may indicate injection attempts. The vulnerability highlights the importance of consistent security controls across all code paths within web applications, particularly in administrative interfaces where privileged access exists, as bypassing security measures through navigation-specific code paths can create persistent attack vectors that persist until properly patched.